mirror of
https://github.com/zebrajr/postgres.git
synced 2025-12-06 00:20:01 +01:00
e0c3d5122e
This function called generate_series() without enforcing its input
argument types, making possible for an attacker to catch this call, by
defining for example a generate_series(int,bigint).
The internals of pg_freespace(regclass) are changed to force the use of
bigint for the inputs of generate_series(). A more consistent style is
applied for all its hardcoded values, while on it.
Issue introduced in 3f323eba89.
Reported-by: Noah Misch
Reviewed-by: Noah Misch
Discussion: https://postgr.es/m/20250106190428.ec.nmisch@google.com
14 lines
554 B
SQL
14 lines
554 B
SQL
/* contrib/pg_freespacemap/pg_freespacemap--1.2--1.3.sql */
|
|
|
|
-- complain if script is sourced in psql, rather than via ALTER EXTENSION
|
|
\echo Use "ALTER EXTENSION pg_freespacemap UPDATE TO '1.3'" to load this file. \quit
|
|
|
|
CREATE OR REPLACE FUNCTION
|
|
pg_freespace(rel regclass, blkno OUT bigint, avail OUT int2)
|
|
RETURNS SETOF RECORD
|
|
LANGUAGE SQL PARALLEL SAFE
|
|
BEGIN ATOMIC
|
|
SELECT blkno, pg_freespace($1, blkno) AS avail
|
|
FROM generate_series('0'::bigint, pg_relation_size($1) / current_setting('block_size'::text)::bigint - '1'::bigint) AS blkno;
|
|
END;
|